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1. INTRODUCTION 

This report describes the first aircraft test of the Autonomous Flight Safety System (AFSS). The 
test was conducted on September 27, 2005, near Kennedy Space Center (KSC) using a privately- 
owned single-engine plane and evaluated the performance of several basic flight safety rules 
using real-time data onboard a moving aerial vehicle. This test follows the first road test of 
AFSS conducted in February 2005 at KSC. 

AFSS is a joint KSC and Wallops Flight Facility (WFF) project that is in its third phase of 
development. AFSS is an independent subsystem intended for use with Expendable Launch 
Vehicles that uses tracking data from redundant onboard sensors to autonomously make flight 
termination decisions using software-based rules implemented on redundant flight processors. 
The goals of this project are to increase capabilities by allowing launches from locations that do 
not have or cannot afford extensive ground-based range safety assets, to decrease range costs, „ 
and to decrease reaction time for special situations. 

The mission rules are configured for each operation by the responsible Range Safety authorities 
and can be loosely categorized in four major categories: Parameter Threshold Violations, 
Physical Boundary Violations — present position and instantaneous impact point (IIP), Gate 
Rules: — static and dynamic, and a Green-Time Rule. Examples of each of these rules were 
evaluated during this aircraft test. 

2. TEST CONFIGURATION 

Hardware 

The test hardware was a subset of the final multiprocessor/sensor design, consisting of a single 
Power PC MIP 405 computer, Javad JNS100 GPS receiver, and battery pack (Figure 1). A 
laptop computer running the AFSS Data Monitor (Figure 2) was used to monitor and control the 
AFSS system and to record sensor data and AFSS event and status messages that were updated at 
10 Hz. The GPS antenna was an inexpensive commercial-off-the-shelf antenna that was simply 
set on the plane’s dash. The aircraft used is shown in Figure 3. 
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Figure 1. Test Hardware 
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Figure 2. The AFSS Data Monitor with typical rocket flight data. 



Figure 3. Cherokee 235 
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Software Setup 

The software setup procedure is itemized below. 

1. Start HyperTerminal 

2. Power Up AFSS Chassis 

3. Start AFSS Data Monitor GUI 

4. On Data Monitor, press Config, select Coml and Archive -> AircraftTestl .tlm, press Done 

5. On Data Monitor, press ConfigRules, select AirCraftConfig.Txt 

6. Press Start 

7. On HyperTerminal Type: AFSSStart 

8. Observe GUI, wait for GPS Receiver to acquire a solution 

9. Just prior to takeoff type: ME (MasterEnable) and RTL (ReadyToLaunch) 

Test Procedure 

The flight path was selected based on close proximity to KSC for convenience and on a 
representative subset of the mission rules that could be easily tested with a small aircraft. The 
specific parameters of the rules to be tested and detailed flight path were coordinated with the 
WFF team members. The test procedure is described below and the nominal flight path is shown 
in Figure 4. Throughout this report, altitudes are given in meters (m) and feet (ft), and speeds are 
given in meters per second (m/s) and knots (kn). 

1. Take off from Merritt Island Airport, climb to 1372 m (4500 ft) and proceed to center 
waypoint on the green leg. 

2. Fly to south waypoint along the green leg. 

3. After flying through the south stationary gate, reboot AFSS. 

4. After AFSS reboots, restart AFSS. 

5. When GPS receiver acquires a solution, engage Master Enable and Ready To Launch. 

6. At an altitude of 1372 m (4500 ft), fly to south waypoint on red leg. 

7. Fly to north end of red leg while climbing to 1676 m (5500 ft). 

8. Fly to north end of blue leg, reducing altitude to 1067 m (3500 ft). 

9. Fly to south end of blue leg at 1067 m (3500 ft). 

10. Stop data monitor and power down. 

11. Repeat if time permits. 

Flight Rules 

The safety rules and the order in which they were tested are described below. For this report, a 
boundary is defined as an arc connecting two latitude/longitude points, and a corridor is defined 
as a closed surface comprised of a set of boundaries. A boundary can be crossed (usually in a 
certain direction), and the present position or IIP is always either inside or outside the test 
corridor. 
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1. Exit Gate. The only exit gate was at the south end of the corridor at 28.18° N latitude when 
the altitude was greater than 1219.2 m (4000 ft) and less than 1524 m (5000 ft). 

2. Moving Gate. A moving gate was tested where its altitude was a linear function of the IIP 
latitude corresponding to 1524 m (5000 ft) at 28.17° N. latitude and 1676 m (5500 ft) at 
28.28° N. latitude. If the plane’s actual altitude exceeded that of this function for the HP's 
latitude, a destruct condition was violated. 

3. Instantaneous Impact Point Corridor Violation. A destruct condition was violated when the 
speed was greater than 10 m/s (~20 kn) and the IIP went outside the corridor’s west boundary 
at -80.9° longitude. 

4. Present Position Boundary Violation. A non-destruct test of the present position was 
performed when the speed was greater than 10 m/s (~20 kn) and the present position crossed 
the west boundary at -80.9° longitude. The way this rule was implemented made it a 
parameter threshold rule. 

5. Present Position Boundary Violation. A non-destruct test of the present position was 
performed when the speed was greater than 10 m/s (~20 kn) and the present position crossed 
the north boundary at 28.36° N. latitude. The way this rule was implemented made it a 
parameter threshold rule. 

6. Green-Time. If updated tracking was unavailable (by disconnecting the antenna from the 
GPS receiver) and the last measured speed was greater than 10 m/s (~20 kn), a destruct 
condition was violated after the maximum default time of 10 s. 

7. Instantaneous Impact Point Corridor Violation. A destruct condition was violated when the 
speed was greater than 10 m/s (~20 kn) and the HP crossed the corridor’s south boundary at 
28.17° N. latitude while the altitude was less than 1219.2 m (4000 ft). Note that the exit gate 
was located at 28.18° N. latitude. This slight difference was set arbitrarily to prevent 
confusion between the exit gate and corridor’s IIP boundary. 

The path and rules were evaluated before the flight using simulators at KSC and WFF, and no 

problems or issues were found. 
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Figure 4. Test map with nominal flight path. The solid black lines represent the test corridor. 
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3. RESULTS 

The actual flight path and the results are shown in Figures 5 and 6. The numbered events 
correspond to the order of the flight rules described in the previous section. Time permitted two 
passes through the test scenario and these are denoted as Tests 1 and 2. Typical speeds were 60 
to 70 m/s (-110 to 135 kn), and typical altitudes were 1000 to 1700 m (-3000 to 5500 ft). Note 
that the nominal flight path shown in Figure 4 was not followed closely but this was not 
necessary so long as the plane stayed within the test corridor when required. 

1. Exit Gate. This gate was successfully crossed when the altitude was 1385 m (4544 ft) for 
Test 1 and 1388 m (4554 ft) for Test 2. 

2. Moving Gate. During Test 1, the aircraft’s altitude of 1624 m (5328 ft) exceeded that of the 
moving gate when the IIP was at 28.242718° N. latitude. During Test 2, the aircraft’s 
altitude of 1645 m (5397 ft) exceeded that of the moving gate when the IIP was at 
28.257206° N. latitude. 

3. Instantaneous Impact Point Corridor Violation. The corridor’s west boundary was violated 
when the IIP’s longitude was less than -80.9° and the speed was greater 10 m/s (-20 kn). 

4. Present Position Boundary Violation. The west boundary was violated when the present 
position’s longitude was less than -80.9° and the speed was greater 10 m/s (-20 kn). 

5. Present Position Boundary Violation. The north boundary was violated when the present 
position’s latitude was greater than 28.36° N. and the speed was greater 10 m/s (-20 kn). 

6. Green-Time. The GPS antenna was disconnected while the speed was greater than 10 m/s 
(-20 kn) and a Green-Time violation occurred 10 s later. 

7. Instantaneous Impact Point Corridor Violation. The corridor’s south boundary was violated 
when the speed was greater than 10 m/s (-20 kn), the DP’s latitude was less than 28.17° N., 
and the altitude was 1081 m (3547 ft) for Test 1 and 1077 m (3533 ft) for Test 2. 

Time to Arm/Destruct 

The time from a violation to the issue of an Arm command was set at 0.3 s and the time from a 
violation to the issue of a Destruct command was set at 0.5 s. Both of these times were verified 
using the recorded data for all violations. The actual times can be within ±0.1 s of these limits 
because of a combination of certain worst-case assumptions, internal processing delays, and a 
predetermined tolerance, which was set to ±1 ms. 

4. CONCLUSION 

This was simple yet valuable test. Examples of each of the major flight rule categories were 
successfully tested and the hardware performed as expected. The next major test will be onboard 
a sounding rocket flight currently scheduled for early 2006. 
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